Allow services to override image CMD while preserving ENTRYPOINT

Many OCI images provide a stable executable in ENTRYPOINT and expect deployment-specific arguments through CMD. Miren currently lets a service either accept both unchanged or set command, which replaces the complete image startup contract with /bin/sh -c.

Add an exec-form args field:

[services.web]
image = "nousresearch/hermes-agent:latest"
args = ["gateway", "run"]
port = 9119

Behavior:

• With neither command nor args, run the image’s ENTRYPOINT + CMD unchanged.
• With nonempty args, preserve the image’s ENTRYPOINT and replace its CMD with the supplied argv.
• With command, retain the existing /bin/sh -c full override.
• Reject services that specify both command and args.
• Do not perform shell expansion or flatten the arguments into a string.

Containerd already provides this behavior through oci.WithImageConfigArgs. Carry the list through app config, version config, sandbox specs, and launch.

Done when:

• args round-trips through the service configuration pipeline.
• Container startup preserves argv boundaries and the image entrypoint.
• Validation rejects an empty args list and the command/args combination.
• A regression test covers an image with both ENTRYPOINT and a default CMD.
• The Hermes recipe can use args = ["gateway", "run"] without reconstructing the image entrypoint.